PT-2022-9256 · Google · Data-Transfer-Project

Jlleitschuh + 1 · Published 2022-03-29 · Updated 2022-05-10 · CVE-2021-22572

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions data-transfer-project versions prior to the version including commit https://github.com/google/data-transfer-project/pull/969

Description The issue arises on unix-like systems where the system temporary directory is shared among all users, allowing any sensitive information written to these files to be visible to all other local users. This occurs because File.createTempFile creates files in the system temporary directory with world-readable permissions.

Recommendations Upgrade past commit https://github.com/google/data-transfer-project/pull/969 to resolve the issue. As a temporary workaround, consider restricting access to the system temporary directory to minimize the risk of sensitive information exposure.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-377

CWE-668

Related Identifiers

CVE-2021-22572

GHSA-22C6-WCJM-QFJG

Affected Products

Data-Transfer-Project

References · 6

• https://github.com/google/data-transfer-project/pull/969 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-22572 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22572 · Vendor Advisory
• https://github.com/google/data-transfer-project · Note
• https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-22c6-wcjm-qfjg · Note
• https://t.me/cibsecurity/39747 · Telegram Post